The governance stack for agentic AI · Runs in your VPC
The open-source AI gateway that governs, not just routes.
Drop AnchorGate in front of your OpenAI, Anthropic, or local-model traffic with one base-URL change. Policy enforces inline, PII is redacted before egress, MCP tool calls are locked down — and every decision is signed into evidence your auditor can verify offline.
One base-URL change · Fail-closed on policy · Signed evidence
- <50ms
- added overhead — inline policy enforcement, regression-gated in CI
- <20ms
- added overhead — async telemetry on the token path
- 3
- interception modes: full · verify · dns-redirect
- L5
- DEMM evidence grade — signed, re-verifiable offline
Budgets and grades as shipped and CI-gated in AnchorGate v0.1 — source on GitHub . 100% open source: proxy, engine, dashboard, and schema.
What is AnchorGate
A governance gateway in the request path
Most AI gateways route, cache, and fail over. AnchorGate is OpenAI-compatible on both sides like they are — but it exists to answer a different question: what happened to every request, and can you prove it? Today the evidence for that is screenshots and quarterly exports, collected by tools that were never in the path. AnchorGate answers in the path, not after the fact.
- 1 you
Route traffic through the gate
Point your OpenAI or Anthropic base URL at AnchorProxy — one environment variable, no SDK swap. Choose full mode for inline enforcement, verify mode to observe without blocking, or DNS redirect to catch the estates you don’t control.
- 2 gate
Policies enforce inline
A compiled policy bundle evaluates every request before it egresses: PII redacted, MCP targets matched byte-for-byte, high-band risks quarantined with a human alerted. Verdicts are deontic — admitted, narrowed, refused, quarantined — and land in under 50ms of overhead.
- 3 auditor
Export the Trust Packet
Every decision is signed with ECDSA P-256 over canonical JSON and appended to an immutable ledger. One export hands your auditor the manifest, the public key, and every signed event — re-verifiable offline, with no dashboard access and no trust in the vendor required.
Why AnchorGate
What you get at the gate
Everything an AI gateway should do when the traffic is regulated: enforce inline, redact before egress, lock down tool calls — and sign the record of every decision it makes.
Inline policy enforcement
A deterministic policy DSL — IF condition THEN redact, alert, or block — compiled, human-approved, and evaluated before a request leaves. No LLM judging LLMs: the same input always gets the same verdict.
PII redaction before egress
SSNs, emails, Luhn-validated card numbers, and phone numbers stripped inline — before the request reaches any model provider. Responses and streamed output are scanned too.
MCP tool-call security
Deny-by-default: exact-string target allowlists (wildcards deliberately unsupported), shell invocations rejected outright, and single-use task-bound tokens that burn on first use.
Signed, reconstructable evidence
Every decision signed with ECDSA P-256 over RFC 8785 canonical JSON, appended to an immutable ledger, graded L1–L5. An auditor can replay who acted, what was touched, and which policy fired.
Live compliance posture
Control catalogues for the EU AI Act, ISO/IEC 42001, and SOC 2 map directly onto decision evidence. Posture is computed from what the gates actually did — not from a policy document.
Shadow-AI discovery
Feed it DNS and HTTP egress logs and it inventories calls to 16+ AI provider domains — surfacing the copilots and scripts nobody registered. You can’t govern traffic you can’t see.
OpenAI-compatible
Integrate with one base-URL change
AnchorProxy speaks the OpenAI API. Keep your SDK — change the base URL, and every request now crosses the policy gate.
from openai import OpenAI
client = OpenAI(base_url="http://localhost:8080/v1") # was api.openai.com
response = client.chat.completions.create(
model="gpt-4.1",
messages=[{"role": "user", "content": "Hello through the gate"}],
)
Fronts OpenAI, Anthropic, and any OpenAI-compatible server — Ollama, vLLM — with configurable fallback between upstreams. Full quickstart →
Governance & evidence
Evidence that survives the question “says who?”
One export: a manifest of scope and thresholds, the signing public key, and every decision event with its exact canonical payload and signature. Your auditor re-verifies each record offline — against the key, not against our word. If a byte changed anywhere, verification fails. Every record maps onto EU AI Act, ISO/IEC 42001, and SOC 2 control catalogues.
- No dashboard access required — the packet is self-contained.
- Signatures cover a stored canonical payload, so verification never depends on database round-tripping.
- Each record carries its DEMM grade: how far up the ladder from “screenshot” to “reconstructable” it stands.
Where it fits
Keep your router. Add a governor.
Already run a gateway for routing and failover? Keep it. AnchorProxy is OpenAI-compatible on both sides, so it chains in front of it or behind it — your gateway does the routing, AnchorGate does the governing. We don’t compete on routing benchmarks, and we won’t pretend to. Here’s the difference in kind:
Routing-focused gateways
Built to optimize the request path — routing, failover, caching. Governance is a plugin.
AnchorGate
Built to govern the request path. Deterministic policy in the hot path, fail-closed when it can’t decide.
Routing-focused gateways
Guardrails as best-effort filters — often another model judging the traffic, often fail-open under load.
AnchorGate
A compiled policy DSL, human-approved before it activates. The same input always gets the same verdict, under 50ms.
Routing-focused gateways
Logs and traces you can read — mutable rows you have to trust.
AnchorGate
ECDSA P-256-signed decision events in an append-only ledger, exportable as a Trust Packet your auditor verifies offline.
Routing-focused gateways
MCP is one more protocol to proxy through.
AnchorGate
MCP is an attack surface: exact-string allowlists, shell invocations rejected, single-use task-bound tokens.
Pricing
Open source now. Enterprise when you are.
The full gateway is free and self-hosted — no feature gates, no usage caps. Enterprise adds SSO, org-wide RBAC, deployment options, and SLAs around the same open-source gate.
Open Source
$0 forever
The complete stack — proxy, engine, dashboard, Trust Packet export — self-hosted in your VPC. No feature gates, no usage caps, no phone-home.
Deploy the stackDesign Partner
Free · limited slots
Everything in Open Source — there is no gated build — plus deployment support and a direct line to the maintainers while it’s v0.1.
Email usDesign partners
No borrowed logos. A standing offer instead.
AnchorGate is v0.1. We don’t have testimonials yet, and we won’t invent them — what we have is a program for the first teams who put real traffic through the gate. We’d rather build with five serious teams than sell to fifty.
Who it’s for
- Platform and GRC teams facing an EU AI Act, ISO/IEC 42001, or SOC 2 conversation this year
- Agentic workloads — RAG, copilots, MCP tool use — running in regulated environments
- Teams that want enforcement and evidence from the same gate their traffic already crosses
The exchange
You get
- A direct line to the maintainers, not a ticket queue
- Deployment support in your VPC
- Your governance requirements shaping the roadmap
We get
- Your ugliest governance requirements, stated plainly
- Feedback from a real deployment — not a demo
FAQ
The questions platform and GRC teams ask first
- How much latency does the gate add?
- The budgets are explicit and regression-gated in CI: under 20ms of added overhead for async telemetry, under 50ms for inline policy enforcement. The high-volume token path (the proxy) is architecturally separated from policy compilation, evidence signing, and compliance mapping (the engine), so the expensive work never sits on your request path.
- Do prompts or PII ever leave my network?
- No. AnchorGate is self-hosted — Docker Compose or Helm, in your VPC. PII redaction happens inline, before a request egresses to any model provider, and all telemetry is processed inside your own boundary. There is no AnchorGate cloud that sees your traffic.
- Does deploying it make us EU AI Act compliant?
- No tool makes you compliant, and you should distrust any that claims to. What AnchorGate does is map every signed decision event onto concrete control catalogues for the EU AI Act, ISO/IEC 42001, and SOC 2 — including the records of operation Article 12 asks for — so your posture is computed from what your gates actually did, not from what a policy PDF says. Your obligations still depend on your role and risk classification.
- Is it really open source?
- The full stack — proxy, engine, dashboard, and the Decision Event Schema — is developed in the open at github.com/anchorgate-ai/anchorgate and runs entirely on your infrastructure. It is v0.1 and early: APIs may move, and we say so rather than pretend otherwise.
Put a gate in front of your agents
One command gets you the full stack — proxy, engine, ledger, dashboard — and one base-URL change puts your first workload behind the gate. We’re looking for design partners running agentic workloads in regulated environments.
View on GitHubor email hello@anchorgate.ai